Method buildUpdateCacheMemoryJob

pkg/workflow/cache.go:908–1080

buildUpdateCacheMemoryJob builds a job that updates cache-memory after detection passes This job downloads cache-memory artifacts and saves them to GitHub Actions cache

(data *WorkflowData, threatDetectionEnabled bool)

// buildUpdateCacheMemoryJob builds a job that updates cache-memory after detection passes
// This job downloads cache-memory artifacts and saves them to GitHub Actions cache
func (c *Compiler) buildUpdateCacheMemoryJob(data *WorkflowData, threatDetectionEnabled bool) (*Job, error) {
	if data.CacheMemoryConfig == nil || len(data.CacheMemoryConfig.Caches) == 0 {
		return nil, nil
	}

	// Only create this job if threat detection is enabled
	// Otherwise, cache is updated automatically by actions/cache post-action
	if !threatDetectionEnabled {
		return nil, nil
	}

	cacheLog.Printf("Building update_cache_memory job for %d caches (threatDetectionEnabled=%v)", len(data.CacheMemoryConfig.Caches), threatDetectionEnabled)

	var steps []string

	// Build steps for each cache
	// In workflow_call context, use the per-invocation prefix from the agent job.
	cacheArtifactPrefix := artifactPrefixExprForAgentDownstreamJob(data)

	for _, cache := range data.CacheMemoryConfig.Caches {
		// Skip restore-only caches
		if cache.RestoreOnly {
			continue
		}

		// Determine artifact name and cache directory.
		// Apply the workflow_call prefix to ensure we download the correct invocation's artifact.
		cacheDir := cacheMemoryDirFor(cache.ID)
		var artifactName string
		if cache.ID == "default" {
			artifactName = cacheArtifactPrefix + "cache-memory"
		} else {
			artifactName = cacheArtifactPrefix + "cache-memory-" + cache.ID
		}

		// Download artifact step
		var downloadStep strings.Builder
		// Generate a safe step ID from cache ID (replace hyphens with underscores)
		downloadStepID := strings.ReplaceAll("download_cache_"+cache.ID, "-", "_")
		fmt.Fprintf(&downloadStep, "      - name: Download cache-memory artifact (%s)\n", cache.ID)
		fmt.Fprintf(&downloadStep, "        id: %s\n", downloadStepID)
		fmt.Fprintf(&downloadStep, "        uses: %s\n", c.getActionPin("actions/download-artifact"))
		downloadStep.WriteString("        continue-on-error: true\n")
		downloadStep.WriteString("        with:\n")
		fmt.Fprintf(&downloadStep, "          name: %s\n", artifactName)
		fmt.Fprintf(&downloadStep, "          path: %s\n", cacheDir)
		steps = append(steps, downloadStep.String())

		// Check if cache folder exists and is not empty
		var checkStep strings.Builder
		checkStepID := strings.ReplaceAll("check_cache_"+cache.ID, "-", "_")
		fmt.Fprintf(&checkStep, "      - name: Check if cache-memory folder has content (%s)\n", cache.ID)
		fmt.Fprintf(&checkStep, "        id: %s\n", checkStepID)
		checkStep.WriteString("        shell: bash\n")
		checkStep.WriteString("        run: |\n")
		fmt.Fprintf(&checkStep, "          if [ -d \"%s\" ] && [ \"$(ls -A %s 2>/dev/null)\" ]; then\n", cacheDir, cacheDir)
		checkStep.WriteString("            echo \"has_content=true\" >> \"$GITHUB_OUTPUT\"\n")
		checkStep.WriteString("          else\n")